this post was submitted on 01 Aug 2026
335 points (99.7% liked)

Technology

86780 readers
3843 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
335
CISA Releases Guidance Urging Water Treatment Facilities to Disconnect Equipment From the Internet (www.privacyguides.org)
submitted 19 hours ago by new_otters_raft@piefed.ca to c/technology@lemmy.world
39 comments fedilink hide all child comments
 

CISA released an urgent message warning water utilities to disconnect their logic controllers from the internet in the face of rising cyberattacks.

The hacks target internet-facing programmable logic controllers (PLCs) that control equipment and allow machinery to communicate. They monitor and control the water pressure, chemical dosing, and other factors to ensure the water is safe.

Many of the PLCs are apparently open to the internet and use default credentials, allowing a remote attacker to easily take them over.

I assume it is this CISA: https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency

you are viewing a single comment's thread
view the rest of the comments
[–] sylver_dragon@lemmy.world 50 points 18 hours ago (1 children)

Sadly yes, this is exactly what happens. And it ends up being IT holding the bag at the end, with the managers having long since cashed out their stock options and left.

[–] blargh513@sh.itjust.works 15 points 17 hours ago (1 children)

"Well, we just bought this new monitoring platform from my cousin's company and they need access to it. No, their platform doesn't support any real secure protocols and won't route over a VPN, it needs to be on the same subnet as the devices. Ok, then just open all ports to the network so they can connect. No, they don't know what port or protocol, it also runs out of my cousin's house so it's on a dynamic IP so you can't create some type of access rule for it. Just put an any/any rule in and it's good. What do you mean we already have a monitoring platform? Well, this one is better!"

[–] historicaldocuments@lemmy.world 5 points 9 hours ago

"No, their platform doesn’t support any real secure protocols and won’t route over a VPN, it needs to be on the same subnet as the devices. [...]"

They won't know that much. They don't understand that their job isn't running a water department, it's running the computers that maintain the water department and that includes security. For someone familiar with computer security it's easy to recognize negligence, but until the law sees it as criminal negligence nothing's going to change.

Small town municipal water departments aren't going to be able to afford the guy holding the shield against international state actors.